Skip to main content
CVE-2026-2950VulnerabilityPublished

Red Hat Security Advisory: cockpit-podman security update

Affects Red Hat cockpit-podmanSource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 10 Nov 2026, 19:03 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 10 Nov 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

What to do

AI-suggested

Red Hat has released updated cockpit-podman packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:97537 and the linked article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.

Description

Red Hat has issued a security advisory for the cockpit-podman user interface component in Red Hat Enterprise Linux 9. The update addresses two vulnerabilities in the lodash library: CVE-2026-4800, which allows arbitrary code execution via untrusted input in template imports, and CVE-2026-2950, which enables prototype pollution allowing deletion of built-in prototype properties via an array path bypass. These vulnerabilities have been rated with an important security impact by Red Hat. The advisory provides updated packages to remediate these issues.

References

Community reviews

Loading reviews…